gitlab_member_role: GraphQL error "X is not a valid global id" when creating custom roles with permissions

Bug Report

When creating a gitlab_member_role resource with enabled_permissions, the following GraphQL error is returned:

Error: GitLab GraphQL error occurred

  with gitlab_member_role.example,
  on main.tf line X, in resource "gitlab_member_role" "example":
   X: resource "gitlab_member_role" "example" {

Error 0 message: [PERMISSION_NAME] is not a valid global id

Root Cause

The Create (and likely Update) function in internal/provider/resource_gitlab_member_role.go builds the memberRoleCreate GraphQL mutation using raw string interpolation via fmt.Sprintf. The permissions field is a Go []string, which when formatted with %s produces [PERMISSION_ONE PERMISSION_TWO] — space-separated with no quotes and no commas.

GraphQL expects an enum list in the format [PERMISSION_ONE, PERMISSION_TWO]. The malformed input causes the GraphQL parser to attempt to interpret the value as a global ID type, resulting in the error "X is not a valid global id".

Relevant code (~line 305–340 of resource_gitlab_member_role.go):

var permissions []string
for _, v := range data.EnabledPermissions {
    permissions = append(permissions, v.ValueString())
}

query := gitlab.GraphQLQuery{
    Query: fmt.Sprintf(`
        mutation {
            memberRoleCreate(
                input: {
                    ...
                    permissions: %s   // produces [PERM_A PERM_B], not [PERM_A, PERM_B]
                }
            ) { ... }
        }`, ..., permissions),
}

Implementation Plan

  • Follow the CONTRIBUTING.md guide for setting up your local development environment.
  • Clone the community fork of this project.
  • In internal/provider/resource_gitlab_member_role.go, amend all GraphQL queries to use GraphQL variables instead of string interpolation.
  • In internal/provider/resource_gitlab_member_role_test.go, add or update a test so the first test step is creating a role with multiple permissions.

Relevant Terraform Configuration

resource "gitlab_member_role" "example" {
  name              = "Example Role"
  base_access_level = "DEVELOPER"
  group_path        = "my-group"
  enabled_permissions = [
    "READ_CODE",
    "ADMIN_MERGE_REQUEST",
  ]
}

Relevant Log Output

Error: GitLab GraphQL error occurred

Error 0 message: READ_CODE is not a valid global id

Additional Details

  • Upstream API: GitLab GraphQL memberRoleCreate mutation
  • The error format "Error %d Message: %s" in the provider matches the top-level GraphQL errors array, confirming this is a schema/parse-level error, not a mutation-level validation error.
Edited by 🤖 GitLab Bot 🤖